Immpossible to renew the certificat SSL

Hello,

I renewed the SSL certificat 3 month ago with the command below :

cp -r /etc/letsencrypt/ /etc/letsencrypt16102018
./certbot-auto renew

But when i try to renew amoung 3 month it does'nt work.
Thanks for advance for your help.

My domain is: silex-ip.com

I ran this command:

  1. /etc/letsencrypt# certbot --apache
  2. /etc/letsencrypt# letsencrypt renew
  3. /etc/letsencrypt# ./certbot-auto renew --dry-run

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

Which names would you like to activate HTTPS for?


1: www.silex-ip.com


Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.silex-ip.com
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.silex-ip.com (http-01): urn:ietf:params:acme:error:unauthorized ::
The client lacks sufficient authorization :: Invalid response from
http://www.silex-ip.com/.well-known/acme-challenge/sMagleQpp4uZDTJSvRy7yXnecV6eIqrMYvz1PDnnTE0:
"\n\n403 Forbidden\n\n

Forbidden

\n<p"

IMPORTANT NOTES:

Blockquote

Saving debug log to /var/log/letsencrypt/letsencrypt.log


Processing /etc/letsencrypt/renewal/www.silex-ip.com.conf


Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.silex-ip.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (www.silex-ip.com) from /etc/letsencrypt/renewal/www.silex-ip.com.conf produced an unexpected error: Failed authorization procedure. www.silex-ip.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.silex-ip.com/.well-known/acme-challenge/blbLso5qZ3gwyDmO8HZRHWN3XrWcPC1KKbR2oy3IYv4: "\n\n403 Forbidden\n\n

Forbidden

\n<p". Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.silex-ip.com/fullchain.pem (failure)


All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.silex-ip.com/fullchain.pem (failure)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

Saving debug log to /var/log/letsencrypt/letsencrypt.log


Processing /etc/letsencrypt/renewal/www.silex-ip.com.conf


Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.silex-ip.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (www.domain-name.com) from /etc/letsencrypt/renewal/www.silex-ip.com.conf produced an unexpected error: Failed authorization procedure. www.domain-name.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.domain-name.com/.well-known/acme-challenge/o4StqxWfBd8E63RLymnp3wm1mdigSWjdCmZh1Y7vQ4U: "\n\n403 Forbidden\n\n

Forbidden

\n<p". Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.silex-ip.com/fullchain.pem (failure)


** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.silex-ip.com/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

My web server is (include version): Apache/2.4.18 (Ubuntu)
The operating system my web server runs on is (include version): Ubuntu 16.04.4 LT
I can login to a root shell on my machine (yes or no, or I don't know): yes

/etc/letsencrypt/live/www.silex-ip.com# ll
total 12
drwxr-xr-x 2 root root 4096 Oct 16 13:14 ./
drwx------ 3 root root 4096 Jul 21 17:56 ../
lrwxrwxrwx 1 root root 40 Oct 16 13:14 cert.pem -> ../../archive/www.silex-ip.com/cert2.pem
lrwxrwxrwx 1 root root 41 Oct 16 13:14 chain.pem -> ../../archive/www.silex-ip.com/chain2.pem
lrwxrwxrwx 1 root root 45 Oct 16 13:14 fullchain.pem -> ../../archive/www.silex-ip.com/fullchain2.pem
lrwxrwxrwx 1 root root 43 Oct 16 13:14 privkey.pem -> ../../archive/www.silex-ip.com/privkey2.pem
-rw-r--r-- 1 root root 682 Jul 21 17:56 README

/etc/letsencrypt/archive/www.silex-ip.com# ll
total 40
drwxr-xr-x 2 root root 4096 Oct 16 13:14 ./
drwx------ 3 root root 4096 Jul 21 17:56 ../
-rw-r--r-- 1 root root 2155 Jul 21 17:56 cert1.pem
-rw-r--r-- 1 root root 2159 Oct 16 13:14 cert2.pem
-rw-r--r-- 1 root root 1647 Jul 21 17:56 chain1.pem
-rw-r--r-- 1 root root 1647 Oct 16 13:14 chain2.pem
-rw-r--r-- 1 root root 3802 Jul 21 17:56 fullchain1.pem
-rw-r--r-- 1 root root 3806 Oct 16 13:14 fullchain2.pem
-rw-r--r-- 1 root root 1704 Jul 21 17:56 privkey1.pem
-rw-r--r-- 1 root root 1708 Oct 16 13:14 privkey2.pem

Also i created next folder and file in document root :
.well-known/acme-challenge/test

It is reachable only if i comment the next line in the configuration file :

    <IfModule mod_rewrite.c>
        Options -MultiViews
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !-f
        ##RewriteRule ^(.*)$ app.php [QSA,L]
    </IfModule>
</Directory>

Hi @Metini2019

perhaps you have used tls-sni-01 - validation. This is deprecated, support ends 2019-02-13, so certbot switches to http-01 - validation.

Your error shows a lot of http status 403 - Forbidden. But now I see another error, the "missing slash" problem ( silex-ip.com - Make your website better - DNS, redirects, mixed content, certificates ):

Domainname Http-Status redirect Sec. G
http://silex-ip.com/
54.36.181.18 301 https://www.silex-ip.com 0.060 E
http://www.silex-ip.com/
54.36.181.18 301 https://www.silex-ip.com 0.060 A
https://silex-ip.com/
54.36.181.18 302 SILEX | Home 1.467 N
Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors
https://www.silex-ip.com 302 SILEX | Home 1.287 N
Certificate error: RemoteCertificateChainErrors
https://www.silex-ip.com/
54.36.181.18 302 SILEX | Home 1.380 N
Certificate error: RemoteCertificateChainErrors
SILEX | Home 200 1.330 N
Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors
SILEX | Home 200 1.330 N
Certificate error: RemoteCertificateChainErrors
http://silex-ip.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
54.36.181.18 301 https://www.silex-ip.com.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.053 E
http://www.silex-ip.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
54.36.181.18 301 https://www.silex-ip.com.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.050 A
https://www.silex-ip.com.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de -1 0.013 R
NameResolutionFailure - The remote name could not be resolved: 'www.silex-ip.com.well-known'

The redirect of /.well-known/acme-challenge/file is critical, Letsencrypt checks such a file. http -> https is ok, but the redirect goes to www.silex-ip.com.well-known, this domain doesn't exist.

So check your redirect rule and add a / between something like $ServerName and the rest.

1 Like

Thank you.
/ added in the configuration file in the section of Redirect.
But renewing the certificate doesn't work.

<VirtualHost *:80>
    ServerName www.silex-ip.com
    Redirect permanent / https://www.silex-ip.com/
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName www.silex-ip.com

    LimitRequestBody 1048576

    DocumentRoot /var/www/silex_corp/web
    <Directory  /var/www/silex_corp/web>
        Order Allow,Deny
        Allow from All

        <IfModule mod_rewrite.c>
            Options -MultiViews
            RewriteEngine On
            RewriteCond %{REQUEST_FILENAME} !-f
            RewriteRule ^(.*)$ app.php [QSA,L]
        </IfModule>
    </Directory>

    # uncomment the following lines if you install assets as symlinks
    # or run into problems when compiling LESS/Sass/CoffeScript assets
    # <Directory /var/www/project>
    #     Options FollowSymlinks
    # </Directory>
    <FilesMatch \.php$>
        # 2.4.10+ can proxy to unix socket
        SetHandler "proxy:unix:/var/run/php/php7.2-fpm.sock|fcgi://localhost/"

        # Else we can just use a tcp socket:
        #SetHandler "proxy:fcgi://127.0.0.1:9000"
    </FilesMatch>

    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/www.silex-ip.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/www.silex-ip.com/privkey.pem

    ErrorLog /var/log/apache2/symfony_error.log
    CustomLog /var/log/apache2/symfony_access.log combined
    RewriteCond %{SERVER_NAME} =www.silex-ip.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
</IfModule>

Now you have a http status 500:

https://www.silex-ip.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 500 1.450 N
Internal Server Error
Certificate error: RemoteCertificateChainErrors

The wrong certificate isn’t a problem. The 500 is a problem, there is no content.

You have to fix this 500 - problem.

If this is done, this

/var/www/silex_corp/web

should be your webroot. So you can use it direct:

certbot run -a webroot -i apache -w /var/www/silex_corp/web -d silex-ip.com -d www.silex-ip.com

to split authentication (-a) and installation (-i).

2 Likes

Thank you very much JuergenAuer.
It worked :wink:

3 Likes

Yep, now your site has a new certificate.

CN=silex-ip.com
	15.01.2019
	15.04.2019
	silex-ip.com, www.silex-ip.com - 2 entries

and two correct https - versions.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.